linux-kernel - Re: [PATCH] tty: vt: Fix soft lockup in fbcon cursor blink timer.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160528114410.GA13329@khazad-dum.debian.net>
Date:	Sat, 28 May 2016 08:44:10 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	David Daney <ddaney.cavm@...il.com>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>,
	Peter Hurley <peter@...leysoftware.com>,
	Ming Lei <ming.lei@...onical.com>,
	Dann Frazier <dann.frazier@...onical.com>,
	Scot Doyle <lkml14@...tdoyle.com>,
	David Airlie <airlied@...ux.ie>,
	dri-devel@...ts.freedesktop.org,
	Radha.Chintakuntla@...iumnetworks.com, Pavel Machek <pavel@....cz>,
	linux-kernel@...r.kernel.org, David Daney <david.daney@...ium.com>,
	stable@...r.kernel.org
Subject: Re: [PATCH] tty: vt: Fix soft lockup in fbcon cursor blink timer.

On Tue, 17 May 2016, David Daney wrote:
> From: David Daney <david.daney@...ium.com>
> We are getting somewhat random soft lockups with this signature:
> 
> [   86.992215] [<fffffc00080935e0>] el1_irq+0xa0/0x10c
> [   86.997082] [<fffffc000841822c>] cursor_timer_handler+0x30/0x54
> [   87.002991] [<fffffc000810ec44>] call_timer_fn+0x54/0x1a8
> [   87.008378] [<fffffc000810ef88>] run_timer_softirq+0x1c4/0x2bc
> [   87.014200] [<fffffc000809077c>] __do_softirq+0x114/0x344
> [   87.019590] [<fffffc00080af45c>] irq_exit+0x74/0x98
> [   87.024458] [<fffffc00080fac20>] __handle_domain_irq+0x98/0xfc
> [   87.030278] [<fffffc000809056c>] gic_handle_irq+0x94/0x190
> 
> This is caused by the vt visual_init() function calling into
> fbcon_init() with a vc_cur_blink_ms value of zero.  This is a
> transient condition, as it is later set to a non-zero value.  But, if
> the timer happens to expire while the blink rate is zero, it goes into
> an endless loop, and we get soft lockup.
> 
> The fix is to initialize vc_cur_blink_ms before calling the con_init()
> function.
> 
> Signed-off-by: David Daney <david.daney@...ium.com>
> Cc: stable@...r.kernel.org

Tested-by: Henrique de Moraes Holschuh <hmh@....eng.br> on top of 4.4.11.

> ---
>  drivers/tty/vt/vt.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 3e3c757..eef5c36 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -750,6 +750,7 @@ static void visual_init(struct vc_data *vc, int num, int init)
>  	vc->vc_complement_mask = 0;
>  	vc->vc_can_do_color = 0;
>  	vc->vc_panic_force_write = false;
> +	vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS;
>  	vc->vc_sw->con_init(vc, init);
>  	if (!vc->vc_complement_mask)
>  		vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh